Fallos del tipo CWE-416

6177 resultados

Uso após liberação de memória

Ocorre quando o código tenta acessar uma área de memória que já foi liberada (deallocated). O programa continua usando um ponteiro que aponta para um endereço inválido, causando leitura/escrita em memória não controlada. Isso pode levar a crash, corrupção de dados ou execução arbitrária de código.

Ejemplo

Um navegador aloca memória para um objeto DOM, depois o remove da página e libera a memória. Se um script JavaScript ainda tentar acessar esse objeto deletado, o navegador tenta ler/escrever em um endereço que agora contém outro dado, causando comportamento impredizível ou exploração por atacante.

Cómo mitigar

Use linguagens com garbage collection (Java, Python, C#) ou práticas rigorosas: null os ponteiros após free(), use smart pointers (C++), evite compartilhamento de referências sem sincronização, faça testes de memória com ferramentas como Valgrind ou AddressSanitizer.

CVE-2016-7892HIGHAdobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextFieEPSS 19.1%KEVCVE-2015-5123HIGHUse-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.30EPSS 18.8%KEVCVE-2022-27799HIGHAdobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityEPSS 18.8%CVE-2020-24430HIGHAcrobat Pro DC Use-After-Free vulnerability Could Lead to Arbitrary Code ExecutionEPSS 18.7%CVE-2022-38181HIGHThe Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects BEPSS 18.5%KEVCVE-2022-3842HIGHUse after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to pEPSS 18.3%CVE-2019-8605HIGHA use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watcEPSS 17.6%KEVCVE-2012-4787CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via a crafted web sitEPSS 17.6%CVE-2025-24085CRITICALA use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS EPSS 17.4%KEVCVE-2021-39842HIGHAdobe Acrobat Reader DC messageHandler.OnMessage Use-After-Free VulnerabilityEPSS 17.4%CVE-2013-0022CRITICALUse-after-free vulnerability in Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code via a crafted web site that EPSS 16.8%CVE-2022-22620HIGHA use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15EPSS 16.3%KEVCVE-2024-21407HIGHWindows Hyper-V Remote Code Execution VulnerabilityEPSS 16.3%CVE-2021-45062HIGHAdobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityEPSS 16.2%CVE-2021-21796HIGHAn exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. A specially crafted document can causeEPSS 15.8%CVE-2016-3189MEDIUMUse-after-free vulnerability in bzip2recover in bzip2 1.0.6 allows remote attackers to cause a denial of service (crash) via a crafted bzip2EPSS 15.7%CVE-2024-25938HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a Barcode widget. A specially crafted JavaScript code iEPSS 15.6%CVE-2024-25648HIGHA use-after-free vulnerability exists in the way Foxit Reader 2024.1.0.23997 handles a ComboBox widget. A specially crafted JavaScript code EPSS 15.6%CVE-2026-45657CRITICALWindows Kernel Remote Code Execution VulnerabilityEPSS 15.5%CVE-2023-2723HIGHUse after free in DevTools in Google Chrome prior to 113.0.5672.126 allowed a remote attacker who had compromised the renderer process to poEPSS 15.4%